Wireless Network Hacking

• Concerns for wireless security are similar to those found in a wired environment.
• Security requirements are the same:
  • Confidentiality, integrity, availability, authenticity, accountability
  • Most significant source of risk is the underlying communications medium.

• The 802.11 wireless networks operate in two basic modes:
  • Infrastructure mode
  • Ad-hoc mode
• Infrastructure mode
  • Each wireless client connects directly to a central device called Access Point (AP)
  • No direct connection between wireless clients
  • AP acts as a wireless hub that performs the connections and handles them between wireless clients.

• Ad-hoc mode:
  • Each wireless client connects directly with each other
  • No central device managing the connections.
  • Rapid deployment of a temporal network where no infrastructures exist (advantage in case of disaster…)
  • Each node must maintain its proper authentication list.

q Channel: broadcast communication (more susceptible to eavesdropping and

jamming)

q Mobility: additional risks q Resources: advanced OS (iPhone, Android), but limited resources (memory,

processing)

q Accessibility: Certain devices may be left unattended.

1. Wireless client: WIFI-enabled laptop/tablet, cell phone, Bluetooth device, ...
2. Access point: Cell towers, WIFI hotspots, wireless routers
3. Transmission medium: carries signals

• Use encryption
• Use and enable anti-virus, anti-spyware, firewall
• Turn off SSID broadcasting
• Change default identifier on router
• Change router’s preset password
• Apply MAC-filtering
  • Reduce signal strengths (place away from windows and external walls
  • Directional antennas

• IEEE 802: a committee responsible for LANs
• IEEE 802.11: responsible for developing wireless protocols
  • Many standards
• The Wi-Fi alliance: became popular with 802.11b
  • Wi-Fi Protected Access (WPA, WPA2)

• Wired Equivalent Privacy (WEP)
• Wi-Fi Protected Access (WPA)
• WPA2
• WPA3

• The original native security mechanism for WLAN
• Provides security through an 802.11 network
• Used to protect wireless communication from eavesdropping (confidentiality)
• Prevents unauthorized access to a wireless network (access control)
• Prevents tampering with transmitted messages
• Provides users with the equivalent level of privacy inbuilt in wireless networks.

• Weak keys: ü It allows an attacker to discover the default key being used by the Access Point and client stations ü This enables an attacker to decrypt all messages being sent over the encrypted channel.
• IV (initialization vector) reuse and small size: ü There are 2 24 different IVs ü On a busy network, the IV will surely be reused, if the default key has not been changed and the original message can be retrieved relatively easily.

• New technique in 2002
• Replacement of security flaws of WEP
• Improved data encryption
• Strong user authentication
• Because of many attacks related to static key, WPA minimize shared secret key in accordance with the frame transmission
• Use the RC4 algorithm in a proper way and provide fast transfer of the data before someone can decrypt the data.

• Based on the IEEE 802.i standard
• 2 versions: Personal & Enterprise
• The primary enhancement over WPA is the use of the AES (Advanced Encryption Standard) algorithm
• The encryption in WPA2 is done by utilizing either AES or TKIP

• WPA2 has immunity against many types of hacker attacks ü Man-in-the middle ü Authentication forging ü Replay ü Key collision ü Weak keys ü Packet forging ü Dictionary attacks

Wi-Fi Protected Access 3, or WPA3, superseded WPA2 in 2018. WPA3 is the latest, updated implementation of WPA.

• WPA3 support is not automatically added to every device. Users who wish to use WPA3-approved devices, such as wireless routers, must either buy new routers that support WPA3 or have the device updated by the manufacturer.
• New updates and features of WPA3 include the following:

ü 256-bit Galois/Counter Mode Protocol encryption (GCMP-256); ü 384-bit Hashed Message Authentication Mode (HMAC); ü 256-bit Broadcast/Multicast Integrity Protocol (BIP-GMAC-256);

• Signal hiding (and SSID hiding)
  • Reduce signal strengths
• Encryption: encrypt all wireless transmissions

• Disallow unauthorized access to the AP
• Require authentication for any access including for devices wishing to attach themselves to the AP

The wireless hacking methodology helps an attacker reach the goal of hacking a target wireless Network. An attacker usually follows a hacking methodology to be sure of finding every single entry point to break into the target network.

The attacker uses the following steps to perform wireless hacking:

1. Wi-Fi discovery
2. GPS mapping
3. Wireless traffic analysis
4. Launch of wireless attacks
5. Wi-Fi encryption cracking

Most organizations spend significant amounts of time defining and implementing Wi-Fi security policies, but it may be possible for a client of a wireless network to change the security setting on AP unintentionally.

This in turn may lead to misconfigurations in APs. A misconfigured AP can expose an otherwise well-secured network to attacks. It is difficult to detect a misconfigured AP as it is an authorized, legitimate device on the network.

,

Attackers can easily connect to the secured network through misconfigured APs, and the device continues to function normally as it will not trigger any alerts even if the attacker uses it to compromise security.

attack include:

q SSID Broadcast q Weak Password q Configuration Error